What are SharePoint Permissions?
SharePoint permissions are access controls that allow you to restrict user rights to ensure SharePoint assets are safe and protected.
Advanced user permissions
SharePoint Server includes 33 default user permissions used within the permission levels, which can be configured to perform various tasks. These permission levels provide a general framework to help organizations assign user rights. In some cases, tasks, and scenarios, these permissions might not suit an organization's hierarchical structure needs. Advanced user permissions can be customized to meet specific organization's limitations and tasks. Common types of SharePoint permissions include:
SharePoint site permissions
These permissions can greatly impact site configuration, web interface, and personal settings. Administrators can manage, create, and change permission levels on a site and assign access rights to users or groups.
You can customize site permissions by creating subsites, adding and deleting HTML pages, applying themes and borders, browsing user information, managing alerts, and creating new SharePoint group permissions, and assigning those permissions within the site collection. Users can also utilize remote interface and client integration features.
SharePoint list permissions
Customizing these permissions can directly impact lists, documents, and folder permissions. It can also affect the view of items and application pages.
The administrator can customize and delete lists, edit items, and override list behaviors. Users can also view, approve, and open items and past versions of documents, lists, and folders.
SharePoint custom/personal permissions
SharePoint page permissions can be customized or personalized by adding or removing personal web parts, managing personal views, and updating customized information.
Best practices for assigning permissions
When lists or sites have fine-grained permissions applied to their sub-lists or subsites, it can be difficult to keep track of the unique permissions of each individual or user. Inherited permissions can help simplify the pattern of assigning rights. Organization and management of SharePoint permissions can become easier when there’s a clear hierarchy of permissions and user access rights inherited from the parent. It’s best to arrange lists, subsites, and libraries in a way that they inherit access rights and user permissions directly from the parent. Here are a few best practices for SharePoint:
- Identify actively accessed critical data: Assigning permissions to the content-specific data that requires more granular protection like sites and directories consisting of sensitive data is daunting. It involves the identification of actively accessed sensitive data and individuals working on those lines.
- Classify and track sensitive data: Creating data-specific groups to access the sensitive data is the best way to avoid giving direct permissions to users. This helps in assigning the permissions to those individuals in a content-specific group and not to the entire department.
- Categorize and monitor sensitive data: Classification and identification of sensitive data is crucial for proper governance. Once the data is centralized and stored, admins can control access through permission rights and access management.
- Archive and delete data no longer in use: Limiting the exposure of sensitive data is crucial and admins can do so by reviewing the stale data. They must archive and transfer the data to a location to which a small administrative group has access. Once the data is no longer in use for the organization, it should be deleted.
- Define standards for access permissions: Adopting the least privileged model ensures access to sensitive data is provided only to those users who need it to perform the tasks. By default, SharePoint provides access to owners (full), members (contribute), and visitors (read).
Manage and audit user access rights across your IT infrastructure.